The NFS daemon (aka nfsd) in Sun Solaris 10 and OpenSolaris before snv_106, when NFSv3 is used, does not properly implement combinations of security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the sec=sys and sec=krb5 security modes, related to modes that "override each other."
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 01:01
Type | Values Removed | Values Added |
---|---|---|
References | () http://osvdb.org/52560 - | |
References | () http://secunia.com/advisories/34225 - Vendor Advisory | |
References | () http://secunia.com/advisories/34435 - | |
References | () http://securitytracker.com/id?1021832 - Exploit | |
References | () http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1 - Patch, Vendor Advisory | |
References | () http://sunsolve.sun.com/search/document.do?assetkey=1-66-250306-1 - Patch, Vendor Advisory | |
References | () http://support.avaya.com/elmodocs2/security/ASA-2009-096.htm - | |
References | () http://www.securityfocus.com/bid/34062 - Exploit | |
References | () http://www.vupen.com/english/advisories/2009/0657 - Vendor Advisory | |
References | () http://www.vupen.com/english/advisories/2009/0814 - | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/49171 - |
Information
Published : 2009-03-11 14:19
Updated : 2024-11-21 01:01
NVD link : CVE-2009-0873
Mitre link : CVE-2009-0873
CVE.ORG link : CVE-2009-0873
JSON object : View
Products Affected
sun
- sunos
- solaris
- opensolaris
CWE
CWE-264
Permissions, Privileges, and Access Controls